[Grab your reader’s attention with a great quote from the document or use this space to emphasize a key point. To place this text box anywhere on the page, just drag it.]

REQUEST FOR PROPOSALS

UCO 1002- PCI Compliance Consulting Services

* if RFP is NOT being issued by CUNY Cen extend to other CUNY colleges if solic

Proposal Submission Due Date:

August 26, 2026 by 2:00 pm Eastern Standard Time (EST)

Designated Contact:

[Insert name, title, address and email]

* Only add this “ISSUED ON BEHALF OF” line if RFP is NOT being issued by CUNY Central, and then include name of College. Add option to extend to other CUNY colleges if solicitation is not by CUNY Central

Insert Subject Matter in Footer

Designated Contact:

Name: Helena Gacina Title: Purchasing Manager Address: 205 East 42nd Street

New York, NY 10017 Email: helena.gacina@cuny.edu

Issue Date: July 31, 2026 mailto:helena.gacina@cuny.edu

[this page intentionally left blank] pg 2 of 112

PCI Compliance Consulting Services RFP

Table of Contents

Part 1: Key Events and Dates; Designated Contacts; Proposal Due Location; Contract Term

Part 2: Proposer Qualifications and Requirements; and Diversity Participation Goals

Part 3: Project Objectives and Scope; Detailed Specifications and Deliverables and Certain Contract Specific Provisions

Part 4: Technical and Management Proposal Requirements (Proposal Volume II)

Part 5: Proposal Price Breakdown Pages (Proposal Volume III)

Part 6: Proposal Scoring Criteria and Weights

Part 7: Terms and Conditions of Contract

Part 8: [NA]

Part 9: Supplier Diversity Provisions

Part 10: Important Notices to Proposers, How to Submit a Proposal

FORMS THAT MUST BE SUBMITTED WITH THE PROPOSAL

Form 1: Proper Information and Authorized Signature; Acceptance of Contract Terms; Proper

Certifications; Confidential Information; Signed RFP Addenda; and References

Form 2: Offeror’s Affirmation of Understanding of And Agreement pursuant to State Finance

Law § 139-j(3) and § 139-j(6)(b)

Form 3: Offeror’s Disclosure of Prior Non-Responsibility Determinations and Certification of

Compliance with State Finance Law § 139-j and § 139-k

Form 4: Diversity Practices Questionnaire

Form 5: Supplier Diversity (M/WBE/SDVOB) Utilization Plan and/or Supplier Diversity

(MWBE/SDVOB) Request for Waiver Form. Also see Supplier Diversity Provisions in Part 9.

Form 6: RFP Checklist and Minimum Qualifications Checklist

Form 20: Gender-Based Violence and the Workplace Certification

FORMS THAT CUNY MAY REQUIRE FROM THE PRESUMPTIVE AWARDEE

If required by CUNY, the Presumptive Awardee selected as a result of this solicitation (the “Presumptive Awardee”) shall complete, sign, and submit the following forms and certifications as described in Section 2.3.5 through 2.3.12 of Part 10 of this RFP.

pg 3 of 112

Form 7: Executive Law Article 15-A – Minority and Women-Owned Business Enterprises and

Equal Employment Opportunity Policy Statement

Form 8: Evidence in form and substance satisfactory to the University that the Contractor maintains workers’ compensation coverage and disability insurance coverage as required by the New York State Workers’ Compensation Law, or is exempt from this requirement

Form 9: New York State Vendor Responsibility Questionnaire (NYS VendRep)

Form 10: All documents and information required by the New York City Vendor and Principal

Questionnaire (NYC PASSPort)

FORMS THAT THE CONTRACTOR MUST SUBMIT UPON REQUEST BY CUNY BEFORE,

DURING, AND AFTER THE PROPOSED CONTRACT TERM

Form 11: CUNY Substitute W-9 Form

Form 12: Workforce Utilization Report

Form 13: Supplier Diversity (MWBE/SDVOB) Quarterly Contractor Compliance & Payment

Report

Form 14: State Consultant Services – Contractor’s Planned Employment (Consultant

Disclosure Form A)

Form 15: State Consultant Services Contractor’s Annual Employment Report (Consultant

Disclosure Form B)

Form 16: Tax Law §5-a, Form ST-220-CA – Contractor Certification (Contractor to send to the

University)

Form 17: Tax Law §5-a, Form ST-220-TD – Contractor Certification (Contractor to send to the

State)

Form 18: Certified Weekly Payroll Report

Form 19: Contractor’s Safety Protocols pg 4 of 112

Part 1: Key Events and Dates; Designated Contacts; Proposal Due Location; Contract Term

Key Events and Dates

Action Date

CUNY issues RFP for PCI Compliance Consulting Services

July 31, 2026

Submission of Written Questions-Round 1 Due Date

August 10, 2026 by 2:00 pm Eastern Standard Time (EST)

Submission of Written Questions-Round 2 Due Date

August 18, 2026 by 2:00 pm Eastern Standard Time (EST)

Proposal Submission Due Date and Time August 26, 2026 by 2:00 pm Eastern Standard Time (EST)

**Proposers are advised to read all sections of this RFP document carefully, with emphasis on all terms and conditions. By tendering a response to this solicitation, each proposer agrees that it accepts all terms and conditions in the package without exception. If a vendor requires clarification on, or seeks to propose an exception to, any of the terms and conditions contained in the solicitation package, all such requests must be made in writing prior to the Questions Deadlines listed above. Proposed exceptions will be evaluated on a case-by-case basis, and determinations will be published in a subsequent addendum. Proposers are not to rely upon an exception agreed to for a prior contract award to govern the terms of this solicitation – all proposed exceptions must be introduced and incorporated via addendum issued specifically for this solicitation. A proposer who submits exceptions to the solicitation after the Q&A Period may result in the proposer’s submittal being deemed non-responsive by the University.

CUNY reserves the right to amend any of the above dates and will issue such change in writing.

I. Designated Contact(s):

In compliance with the Procurement Lobbying Law, the individual(s) identified below are the Designated Contact(s) for this Request for Proposals solicitation and may be contacted for all inquiries regarding this solicitation:

The City University of New York 205 East 42nd Street, 10th Floor New York, NY 10017 Attention: Helena Gacina /Purchasing Manager E-mail: helena.gacina@cuny.edu

New York State Procurement Lobbying Law permits rejection of a Proposal if a Proposer has made any unauthorized contact during the Restricted Period (as defined in the Procurement Lobbying Law). Multiple violations of procurement lobbying restrictions regarding permissible contacts may lead to a Proposer’s being debarred from participating in future New York State procurements.

pg 5 of 112 mailto:helena.gacina@cuny.edu

II. Proposal Due Location:

CUNY is not responsible for the delivery or submission of Proposals. Only Proposals that are sent, and accepted by the Designated Contact, shall be accepted. CUNY is not responsible for Proposals received after the deadline, regardless of the reason for lateness.

On a case-by-case basis, CUNY may deem it acceptable for Proposals to be submitted via e-mail. For this solicitation, CUNY will be accepting. Proposals via email. Proposals may be sent to: Helena.Gacina@cuny.edu.

• Proposals submitted via e-mail must include scans of original (wet) signatures and notarizations to be considered a valid Proposal.

• Proposals (including any excel spreadsheets) must be clearly labeled with three (3) separate pdf attachments clearly named for Volume I (Forms), Volume II (Technical

Proposal), and Volume III (Proposal Price).

• Proposals submitted via e-mail must be clearly labeled with Proposer’s name and the

RFP’s Project name by including the following subject line:

[Firm’s Name] – UCO 1002 PCI Compliance Consulting Services Proposal Submission

III. Anticipated Number of Contracts

CUNY anticipates awarding one (1) contract based on an evaluation of best value, as further described in Part 6 of this RFP (such written determination by the University to a Proposer stating that the University has accepted a Proposal, a “Contract Award”).

IV. Anticipated Contract Term:

The term of the Contract will be for three (3) years, commencing on the date that the Contract is approved by the Attorney General and the New York State Comptroller, as applicable. CUNY will have the option to renew this contract for two (2) one-year options at its sole discretion. Such renewal if exercised will be subject to approval from the Attorney General and the New York State Comptroller, as applicable.

V. Questions and Clarifications Regarding RFP Requirements:

All questions, requests for clarifications, or requests for a revision to any term or condition of this RFP must be submitted to the University’s designated contact (see Section I above) prior to the applicable due date(s) for submission of written questions. The University will not consider proposed revisions to the terms and conditions set forth in the RFP after such date(s) and will not negotiate the terms and conditions set forth in the RFP at any other time.

With respect to any requests for revisions to Part 7: Terms and Conditions, please be advised that such requests must be in the following format: a copy of the specific clause with the suggested revisions in redline form. The University will not consider requests for revisions to Part 7 that fail to follow this format.

pg 6 of 112

[intentionally left blank] pg 7 of 112

Part 2: Proposer Qualifications and Requirements; and Diversity Participation Goals

Paragraph I: Minimum Proposer Qualifications (mandatory qualifications):

CUNY is seeking up to three (3) appropriately qualified firms with experience in providing the

Services as described in Part 3, below (the “Project”). To be considered for Contract Award, the

Proposers must meet the following minimum qualifications:

a. Proposers must have a minimum of ten (10) years relevant experience providing Payment

Card Industry Data Security Standard (“PCI DSS”) compliance services as required by this RFP.

b. Proposers must comply with all the regulatory requirements set forth in Parts 3.2 and 3.3 of the Scope of Work.

c. The Proposer must provide a minimum of three (3) relevant references, including the name of the reference, a brief statement describing the relationship between the Proposer and the reference, and the name, title and telephone number of a contact person at the reference. Please obtain prior approval for the University to contact the references.

d. Proposers must be authorized to work in New York State.

e. Proposers’ Subcontractors (as defined below) must also possess appropriate qualifications and an acceptable level of experience, as determined by CUNY in its sole discretion.

Paragraph II: Non-Mandatory Proposer Qualifications:

Preference will be given to Proposers whose teams include former college presidents, chancellors, or deans with public/systems experience.

Paragraph III: Supplier Diversity Participation Goals:

▪ CUNY has established a 30% participation goal (based on the current availability of qualified MWBEs) in the aggregate for New York State certified Minority-Owned Business

Enterprise ("MBE") and Women-Owned Business Enterprises ("WBE", and, together with

MBE, "MWBEs") and a 6% participation goal (based on the current availability of qualified

SDVOBs) for New York State certified Service-Disabled Veteran-Owned Businesses

("SDVOB"), to be part of the proposed team to provide the Services as subcontractor(s) or suppliers (the "Subcontractor(s)"). The Contractor (as defined in Part 3 below) shall be required to use good faith efforts to meet these participation goals.

▪ Proposers may identify potential MWBE Subcontractor(s) by, among other means, referencing the directory of New York State certified MWBEs found at the following pg 8 of 112 internet address: https://ny.newnycontracts.com/

▪ Proposers may identify potential SDVOB Subcontractor(s) by, among other means, referencing the list of New York State certified SDVOBs found at the following internet address: https://ogs.ny.gov/veterans.

As part of the proposer's response, a Supplier Diversity — MWBE/SDVOB Utilization Plan or a Request for Waiver form that is accompanied by supporting documentation must be submitted in order for the proposal to be considered responsive. The selected Contractor will be required to complete a Quarterly Contractor Compliance & Payment Report accompanied by proof of payment to MWBE/SDVOB Subcontractor(s), in such format as shall be required by CUNY on a quarterly basis during the term of the contract.

Sample CUNY Supplier Diversity forms and reports may be found at https://www1.cuny.edu/sites/selltocuny/.

pg 9 of 112 https://ny.newnycontracts.com/ https://ogs.ny.gov/veterans https://www1.cuny.edu/sites/selltocuny/

Part 3: Project Objectives and Scope; Detailed Specifications and Deliverables;

and Contract-Specific Provisions

3.1 Project Objectives and Scope:

The City University of New York (CUNY) is seeking a qualified Contractor to provide Payment Card Industry Data Security Standard (PCI DSS) Compliance Services. The selected Contractor will assist the University in achieving and maintaining compliance with the current PCI DSS, including but not limited to policy and procedure updates, training, and ongoing advisory support. The Contractor will work closely with the University’s PCI team and relevant stakeholders to ensure all requirements are met within mandated timelines.

3.2 Detailed Specifications and Deliverables:

General Requirements:

The Contractors shall provide the following professional services on an ongoing basis, (the “Services”):

• Perform a PCI DSS gap analysis and provide remediation guidance for the University’s cardholder data environment (CDE).

• Update University policies, procedures, and training materials to align with current PCI

DSS.

• Assist with the establishment, maintenance, and management of merchant accounts, merchant IDs, and Payment Gateways.

• Participate in regularly scheduled assessments and meetings with University stakeholders.

• Provide subject matter expertise and guidance to the University.

• Provide support on other related matters as needed.

• Provide phone, email, and online support assistance to CUNY merchants during normal business hours.

• Provide ongoing support for managing SAQs, TPSPs, and other components of CUNY’s payment ecosystem.

• Conduct continuous research and discovery to identify vulnerabilities or compliance gaps within merchant environments.

3.3 Specific Task and Deliverables

3.3.1 General

• Assist with (as needed) review and assess credit card data devices and network infrastructure against PCI DSS requirements.

• Assist with performing control observation, review, and validation.

• Identify risks and gaps that may lead to non-compliance and provide remediation steps.

3.3.2 Policy, Procedures and Training

• Develop and deliver updated PCI DSS policies and procedures, including:

pg 10 of 112 o Device Inspection Guide & Checklist o Self-Assessment Questionnaire (SAQ) Training o PCI DSS Compliance Checklist o Service Provider Checklist o Procedures for External & Internal Vulnerability Scanning

• Design and/or deliver supplemental training materials.

• Maintain annual PCI training for the University in compliance with current PCI DSS.

3.3.3 Ongoing Support and Advisory

• Monitor industry updates and provide ongoing guidance on technical requirements under PCI DSS.

• Participate in project/program management and planning activities related to PCI compliance.

• Create reusable templates to streamline future certification efforts.

• Assist with evaluation and implementation of new payment solutions aligned with PCI

DSS and institutional needs.

• Review third-party contracts for PCI compliance requirements and recommend modifications.

• Assess new and existing payment card environments for compliance and providing recommendations to address vulnerability gaps.

3.3.4 Documentation and Reporting

• Review existing documentation, including network diagrams, process/data flow diagrams, policies, procedures, and previous ROC.

• Maintain electronic records of all compliance activities, findings, and deliverables.

• Provide management reports and customized reports as requested.

• Assist with reviewing PCI DSS Attestation of Compliance (AOC) from third parties.

• Maintain version-controlled documentation for all CUNY PCI policies, procedures, diagrams, and system inventories.

3.3.5 Merchant Account and Gateway Management

• Merchant Accounts and IDs: Assist with the establishment, maintenance, and management of merchant accounts and IDs, coordinating with financial institutions, acquirers, and stakeholders to ensure compliance.

• Assist with Payment Gateways (as needed): Set up, configure, and maintain secure payment gateways integrated with processors.

• Assist with Set Up and Test System and Configuration (as needed): Support system setup and testing of card transactions prior to production use.

• Provide payment-system onboarding support for campus merchant environments

3.3.6 Equipment and Technology Support

• Equipment and Software: Recommend PCI-approved hardware and software, assist with system tests for compliance, and remediate issues before deployment.

pg 11 of 112

• General Payment Systems Troubleshooting: assist with troubleshooting technical issues such as hardware failures, software errors, and transaction processing problems.

• Provide coordination for multi-campus deployments or system standardization efforts.

3.3.7 Payment Solution Evaluation and Recommendation

• Recommend secure solutions for card-present, online, and mobile payments.

• Ensure recommended solutions reduce PCI scope wherever possible through validated

P2PE, tokenization, EMV, and NFC support.

• Ensure solutions include tiered access, admin-level controls, and user lifecycle management.

• Provide recommendations that promote University-wide standardization of payment systems, processors, and software.

• Provide detailed solution comparison reports outlining scope reduction impact, compliance benefits, operational fit, and cost considerations.

• Ensure solutions support custom reporting, financial tracking, and reconciliation functionality.

3.3.8 Compliance and Regulatory Requirements

• Contractor must comply with all applicable federal, state, and local statutes, laws, ordinances, and regulations, including:

o FERPA, Federal Privacy Act, Gramm-Leach-Bliley Act o Relevant state and city finance laws and consumer protection rules

3.3.9 Subcontracting and Team Requirements

• No subcontracting without prior written approval from the University.

• Contractor must provide documentation of qualifications for all proposed key team members.

• Contractor must maintain continuity of the project team and notify the University of any changes.

3.3.10 Confidentiality and Data Security

• Contractor must adhere to strict confidentiality and data security protocols.

• All confidential information must be stored securely and access restricted to authorized personnel.

• Contractor must notify the University of any breach of security or unauthorized disclosure.

3.4 Contract-Specific Provisions: General Contractor Responsibilities

1. Subcontracting

Contractor shall not subcontract any part or the entire Contract without the prior written consent of CUNY, which may be withheld, conditioned, or rescinded at CUNY’s sole and pg 12 of 112 absolute discretion. CUNY may request information concerning the qualifications and experience of any proposed subcontractor, and Contractor shall provide such information promptly upon CUNY’s request. CUNY reserves the right to require that any previously approved Subcontractor be removed from the Project, and Contractor shall remove any such Subcontractor following notice from CUNY by the deadline specified by CUNY in such notice.

2. Location of Services

Contractor shall provide and use its own equipment for its staff providing the Services.

3. Project Team

Contractor shall designate in writing to CUNY a project manager of Contractor’s firm as Contractor’s project manager for this Project (“Project Manager”). The Project Manager shall:

a. serve as principal liaison between CUNY and Contractor for purposes of administration of the Contract;

b. be an employee of the Contractor (and not a consultant, contractor or subcontractor);

c. have full decision-making authority on behalf of Contractor including authority to obligate

Contractor;

d. maintain control over the work duties, schedule, and performance of the Contractor team;

e. conduct status meetings and provide status reports as requested;

f. provide meeting summaries (minutes) within three (3) business days of meetings; and

g. resolve any CUNY questions and comments on the submitted deliverables.

Contractor shall provide documentation with respect to all proposed initial and replacement Key Team Members of the Contractor Project Team showing that these individuals meet the qualifications required to perform the Services.

Contractor shall make best efforts to maintain continuity of the Contractor Project Team and Key Team Members. Contractor shall notify CUNY in writing prior to any replacement of Key Team Members. CUNY reserves the right to approve or reject any employees proposed to replace Contractor Project Team employees.

Nothing in this section shall be deemed to preclude CUNY from discussing any matters relating to Contract with any other members of Contractor’s organization.

4. Communications

Contractor shall obtain CUNY’s prior written approval before Contractor, or any of its officers, employees, agents or subcontractor(s), makes any statement to the press or issues any communication or publication concerning, or related to, the Services.

5. Document Delivery

a. Contractor shall provide any deliverables requested by the University (together with the

Report, the “Deliverables”) to the University in sufficient time for CUNY review, including modification and final approval. Contractor shall respond to any CUNY comments to the Deliverables, make such modifications as may be necessary, and resubmit updated draft Deliverables to CUNY until receiving final approval in writing from pg 13 of 112

CUNY (“Acceptance”).

b. Contractor shall transmit each deliverable to the University with a dated and signed transmittal letter.

6. Return of CUNY Information at Termination

Contractor shall, within ten (10) calendar days of termination of Services for any reason, with respect to all CUNY documents and data, in whatever media, whether originally provided or created during performance of the Services:

a. return them to CUNY; or, at Contactor’s discretion,

b. destroy them and provide independent certification of destruction of all copies.

7. Invoices and Payment

a. Contractor shall submit invoices to University’s Accounts Payable Department, invoices@cuny.edu, at a time interval and in a format approved by the University.

b. Contractor shall provide sufficient and appropriate documentation with invoices. For each year in which at least one Purchase Order was issued to Contractor during the billing period, invoices shall indicate the Unit Price per Evaluation for that year (from Part 5 of this RFP), multiplied by the quantity of Evaluations performed during the billing period for which the Purchase Order was issued during that year. The University agrees to pay, and the Contractor agrees to accept, an amount not to exceed the Proposal Price indicated in the Proposal Price Breakdown (Part 5 of this RFP) multiplied by the total number of Evaluations performed as the maximum payment for the Services provided under this Contract. There is no minimum guarantee of Services under this Contract and Contractor’s Proposal Price shall in no way be construed as a guaranteed payment. The University reserves the right to request additional information at any time.

c. Contractor acknowledges and agrees that the University will pay Contractor only upon acceptance of properly prepared invoices with sufficient supporting documentation and only after Contractor has received Acceptance from the University of each of the Deliverables for each Evaluation appearing on the invoice.

d. The University will not pay Contractor for work performed beyond the scope of this Project or for any change order not duly authorized.

e. Report preparation, including editing, printing, and delivery to the University shall be the sole responsibility of the Contractor and shall not be reimbursable as a direct cost. If unusual circumstances are encountered that make it necessary for the Contractor to do additional work, Contractor shall report such conditions to University. No additional work may be performed unless authorized by CUNY in writing in advance.

8. Miscellaneous

a. University will identify a contract manager (or alternate) to act as the liaison with the Contractor.

pg 14 of 112

b. Contractor acknowledges and agrees that the University will not provide clerical support.

c. Contractor acknowledges and agrees that Contractor will not be provided computer time or the use of computer hardware and software.

d. Before performing any work under the Contract, Contractor shall procure and maintain with companies satisfactory to CUNY, the types of insurance in the amounts outlined in herein. Contractor shall maintain said insurance during the term of the Contract up and to the date of the final acceptance of the work, or termination of the Contract, whichever occurs later.

9. Insurance

9.1 Before performing any Work and during performance of this Contract and up to the date of final acceptance of the Work, Contractor shall procure and maintain with companies satisfactory to the University, the following types of insurance, in the amounts shown below.

9.1.1 Workers' Compensation Insurance: Statutory Workers'

Compensation Insurance in accord with the Laws of the State on behalf of all employees who are to provide labor or service under this Contract.

9.1.2 Professional Liability/Errors& Omissions and Internet Policies:

Professional Liability/Error & Omissions and Internet Policies in the Contractor’s name. The policy(ies) shall include coverage to the above-named entities for professional services, security and privacy, and include a waiver of subrogation in favor of the University. Such insurance shall be in an amount not less than one million dollars ($ 1,000,000) per occurrence.

9.2 Contractor shall deliver to the University certificates of such insurance or authority for self-insurance before Contractor commences the Work and/or upon request by the University.

9.3 Contractor shall ensure that no insurance policy required by this Contract may be canceled, terminated, modified or changed by Contractor's insurer unless thirty (30) calendar days’ prior written notice is sent by certified mail to the University.

9.4 Contractor shall ensure that no insurance policy required by this Contract shall be canceled, terminated, modified or changed by Contractor's insurer without prior written consent of the University.

9.5 No insurance policy required hereunder shall be invalidated by reason of any of the terms of any policy issued by the insurance company to pg 15 of 112

9.6 Through an executed amendment to this Contract by the University and Contractor, the University reserves the right to add additional insurance requirements and Contractor shall procure such additional insurance requirements within such period as the parties agree in the amendment.

9.7 The University reserves the right to request certified complete copies of required insurance policies at any time. Contractor shall provide such requested copies within three (3) calendar days of notice of request for same.

pg 16 of 112

CUNY Service Provider Standard July 15, 2024 Page 1 of 12

10. CUNY Service Provider Standard

City University of New York Cybersecurity Standards

Standard Owner: CUNY Computing and Information Systems

Approvers: Eusebio Formoso, Vice Chancellor for Information Technology and University CIO

Effective Date: July 15, 2024

Contents

1.0 Purpose

2.0 Audience

3.0 Scope

4.0 Definitions

5.0 Resources

6.0 Standard Statements

7.0 Applicable Policies, Rules, Laws, and Regulations

8.0 Related Standards, Guidelines, Procedures, and Best Practices

9.0 Approvals

10.0 Revision History

1.0 Purpose

This standard defines the security requirements for engaging Service Providers that host or process City University of New York (CUNY) data, including:

▪ Establishing an engagement-specific strategy for managing Confidential Data access, use, and destruction.

▪ Documenting and communicating the processes and guidelines developed to help proactively manage and safeguard CUNY data throughout the engagement lifecycle.

▪ Creating a better understanding of security and privacy requirements for handling CUNY Data during and after the engagement.

▪ Preventing, detecting, and correcting confidentiality incidents on the project.

By adhering to the requirements in this standard, Service Providers can help CUNY maintain the security and integrity of the CUNY network and data.

2.0 Audience

July 15, 2024 Page 2 of 12

2.0 Audience

Service Providers that host, access, or process CUNY data.

3.0 Scope

This standard applies to all work, applications, and services contracted by the City University of New York for hosting, accessing, or processing CUNY data.

4.0 Definitions

The following terms are used in this standard:

Cloud Computing

As defined by the National Institute of Standards and Technology (NIST), “Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable, computing resources (e.g., networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management effort or Service interaction: three service models and four deployment models.”

Cloud Computing Deployment Models

Private cloud. The cloud infrastructure is operated solely for CUNY. It may be managed by CUNY or a Service Provider and may exist on premise or off premise. The private cloud model is typically considered the lowest risk out of the different deployment models.

Community cloud. Several organizations share the cloud infrastructure and support a specific community that has shared concerns (for example, mission, security requirements, policy, and compliance considerations). It may be managed by CUNY or a third-party Service Provider and may exist on premises or off premises.

Public cloud. The cloud infrastructure is made available to the general public, or a large industry group, and is owned by an organization selling cloud services. The public cloud model is typically considered the highest risk due to its wide-scale accessibility and limited segregation of services.

Hybrid cloud. The cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds). The evaluation of risk at the hybrid cloud model is unique to each deployment.

Cloud Computing Service Models

Software as a Service (SaaS). The capability allows CUNY to use the provider’s applications running on the provider’s cloud infrastructure. The applications are accessible from various CUNY devices through a thin client interface such as a web browser (e.g., web-based email). The Service Provider in this case is responsible for the highest amount of security and data protection under this model.

5.0 Resources

July 15, 2024 Page 3 of 12

Platform as a Service (PaaS). The capability provides CUNY the ability to deploy onto the cloud infrastructure CUNY-created or acquired applications created using programming languages and tools supported by the provider. PaaS adds a layer of integration with application development frameworks, middleware capabilities that allow developers to build applications on the platform with programming languages and tools supported by the stack. Security is a shared responsibility with the provider responsible for the underlying platform infrastructure, and CUNY is responsible for securing the applications developed on the platform.

Infrastructure as a Service (IaaS). The capability provides CUNY with the provision processing, storage, networks, and other fundamental computing resources where CUNY can deploy and run arbitrary software, which can include operating systems and applications. The computing infrastructure is typically deployed as a virtual environment. CUNY is responsible for the highest amount of security and data protection under this model.

CUNY Classified Confidential Data

As defined by CUNY Information Security policy, Data Classification Standard, CUNY Classified Confidential Data includes the following types of data: Personal Identifiable Information (PII), New York State Private Information, Personal Identifiable Education Records, Student ID, Protected Health information (PHI), Citizenship, Personnel Records, Payment Card Information, Covered Financial Information, Restricted Procurement information, Federal Tax Information (FTI), Intellectual Property, Personally Identifiable and Restricted Research Data, Passwords and Access codes, Export Controlled Materials, Other Confidential Information.

Service Provider

Any vendor that provides services that may impact the Confidential Data of CUNY users or students’ entities, such as the following examples:

▪ Data center provider

▪ Software as a service (SaaS)

▪ Disaster Recovery as a Service

▪ Any managed services-dealing with confidential data

▪ Payroll processors

▪ Medical Claim Processor

▪ Loan serving company.

▪ Any Service Provider that process/collect payments on behalf of CUNY

CUNY Shared Data

Data that is owned by CUNY, regardless of the class, that has been shared with the Service Provider. All CUNY owned data shall not be stored/hosted/processed outside of the US territories.

5.0 Resources

The following individuals and groups are responsible for developing and managing this standard:

https://www.cuny.edu/wp-content/uploads/sites/4/page-assets/about/administration/offices/cis/information-security/security-policies-procedures/Data-Classification-Standard-CUNY-2019-8-19a.pdf

6.0 Standard Statements

July 15, 2024 Page 4 of 12

▪ University Chief Cybersecurity Risk Officer

▪ University Chief Information Security Officer

▪ Computing and Information Services offices of Information Security and Cybersecurity

6.0 Standard Statements

6.1 Security Requirements

6.1.1 Access Control and Privilege Management

▪ CUNY will grant Service Provider Employees access to CUNY-hosted and/or managed infrastructure and systems (“CUNY systems”) prior to the commencement of the project (e.g., Secure File Transfer Protocol-SFTP, approved collaboration sites, etc.).

▪ The access of Service Provider Employees to CUNY data will be restricted to the data provided by CUNY, located on CUNY systems.

▪ CUNY will always retain control over Service Provider Employees’ access to CUNY systems.

▪ CUNY Confidential Data should not be stored in locations external to CUNY systems.

Confidential Data should not be downloaded to a portable device. Any exception will need to go through CUNY Cybersecurity office for a formal security review and approval in advance of engagement.

▪ The principle of Least Privilege must be implemented, which involves granting the minimal level of access necessary for each role, including specific security functions and privileged accounts. Additionally, the maintenance of Segregation of Functions must be ensured, which involves dividing responsibilities among different roles or individuals to prevent potential conflicts of interest or misuse of power. This segregation should be consistently upheld.

▪ Service Provider Employees will comply with CUNY security protocols for access to CUNY systems, including connecting to CUNY systems using Virtual Private Network (VPN), Multi Factor Authentication, Remote Desktop and/or other secure methods as defined by CUNY.

▪ All data received from CUNY must be used solely for the stated and agreed purpose.

▪ CUNY provided Confidential Data may not be hosted by “offshore” datacenters, outside of the United States or its territories, without explicit written authorization by CUNY. All physical locations where Confidential Data is stored, transmitted, processed and/or received must remain within the United States or its territories. This includes all primary and secondary data centers and any backup facilities. Additionally, cloud environments (and any components, including storage, virtualization, operating systems and networking) must all reside in the US territories. Furthermore, Confidential Data may not be received, stored, processed, or disposed of via information technology systems located offshore.

▪ Access to the system is allowed from offshore locations, but it is mandatory to have certain security measures in place. These include Data Loss Prevention (DLP), Multi- Factor Authentication (MFA), and controlled access. Additionally, all activities must be monitored.

July 15, 2024 Page 5 of 12

▪ Confidential Data can be accessed by the Service Provider’s employees from networks located outside the United States. However, while doing so, they must adhere to all the security requirements outlined in this document. To ensure compliance with these requirements, a periodic audit review and certification by an independent and certified audit firm is necessary. This certification, which demonstrates compliance, must be renewed annually or whenever requested by CUNY.

▪ User sessions should be locked after 15 minutes of inactivity and remote user sessions should be terminated after 30 minutes of inactivity.

▪ All remote user sessions should be monitored for security vulnerabilities.

6.1.2 Awareness and Training

▪ CUNY mandates that all employees and consultants complete the CUNY Cybersecurity Training courses.

▪ CUNY stipulates that all Service Providers must provide security awareness training to all their staff members who have access to CUNY Confidential Infrastructure.

6.1.3 Audit and Accountability

▪ Audit logs must be configured to track activities occurring on the system. They should also include requirements for establishing audit-related processes at the application and system levels. Within the application, auditing should be activated to the extent necessary to record access, modification, deletion, and movement of Confidential Data provided by CUNY by each unique user. This auditing requirement extends to data tables or databases embedded in or located outside of the application.

▪ Service Providers should have the capability to log, audit, monitor, and report Confidential Data access history as required.

▪ All technology Service Providers must enable file-level data access history, regardless of whether they are using on-premises or cloud hosting solutions.

▪ Detection and prevention of data loss at the file level must be enabled for all technology Service Providers, irrespective of whether they are using on-premises or cloud hosting solutions.

▪ All security requirements outlined in this document must be adhered to, and a periodic audit review and certification by an independent/certified audit firm is mandatory;

recertification demonstrating compliance is required annually or upon request by CUNY.

6.1.4 Identification and Authentication

▪ User access control must be implemented to identify who has accessed CUNY shared data. User access must be logged for auditing purposes. All log data should be available, if needed, for a minimum of 1 year.

▪ Before granting access to the City University of New York (CUNY) systems and Critical Infrastructure, it is essential to authenticate the identities of all users, processes, or devices. To maintain continued access, all granted access must undergo a recertification process annually.

▪ Multifactor Authentication must be activated for both local and network access to CUNY systems and Confidential Data. All Service Providers will need to enforce password

July 15, 2024 Page 6 of 12 policy that meets or exceeds the password security published in the NIST Special Publication (SP) 800-63-3 “Digital Identity Guidelines” as minimum standard. Access will need to be disabled for Inactive users after 90 days of inactivity.

6.1.5 Maintenance/ Patch Update

The system (hardware and software) used to receive, store and process CUNY data must be kept up to date with the necessary patches for known security vulnerabilities according to the New York State published IT standard (New York State Information Technology Standard: No. NYS-S15-001: IT Standard Patch Management).

6.1.6 Media Protection

▪ System media containing Confidential Data must be sanitized or destroyed before disposal or release for reuse. The Service Provider is required to dispose of systems/devices containing Confidential Data in accordance with the disposal standards published by the New York State (New York State Information Technology Standard No.

NYS—S13-003: IT Standard Sanitization/Secure Disposal).

▪ Storing Confidential Data on physical/portable media (CD, USB, Paper, etc.) is prohibited.

▪ Any printed materials containing Confidential Data should be destroyed using locked shredding containers as soon as the materials are no longer required.

▪ Any media used in the backup and recovery system should be treated with the same as the primary system, with the same security safeguard measures.

6.1.7 Encryption

▪ Service Providers shall adhere to the established New York State Information Technology Standard on encryption (New York State Information Technology Standard No. NYS—S14-007: IT Standard Encryption).

▪ Approved encryption algorithms must be (of a minimum key length of 256 bits) used for CUNY Confidential Data at rest and data in transit.

▪ Key Management requirements:

- Establish and manage cryptographic keys for cryptography employed in organizational systems.

- Private keys must be kept confidential.

- Key lifecycle management must be implemented.

- Keys in storage and transit must be encrypted.

- Keys must be chosen randomly from the entire key space.

- Encryption keys must allow for retrieval for administrative or forensic use.

6.1.8 Data At Rest and In Transit

▪ Confidential Data stored in a database or filesystem (at rest) must be encrypted as per the New York State Encryption Standard.

▪ Password protection is not deemed an acceptable alternative to encryption for protecting Confidential Data.

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf https://its.ny.gov/system/files/documents/2023/04/nys-s15-001-patch-management-standard.pdf https://its.ny.gov/system/files/documents/2023/04/nys-s15-001-patch-management-standard.pdf https://its.ny.gov/system/files/documents/2022/10/nys-s13-003_sanitization_secure_disposal_standard.pdf https://its.ny.gov/system/files/documents/2022/10/nys-s13-003_sanitization_secure_disposal_standard.pdf https://its.ny.gov/system/files/documents/2023/04/nys-s14-007-encryption-standard.pdf

July 15, 2024 Page 7 of 12

▪ The preferred method for transporting Confidential Data to meet business needs is using the CUNY infrastructure. Confidential Data that is transmitted electronically must be encrypted during transmission. The preferred methods of data transfer include CUNY SFTP, Network Drive, and CUNY collaboration sites approved for Confidential Data.

▪ Confidential Data sent across any network connection must be encrypted according to the New York State Encryption Standard (New York State Information Technology Standard No. NYS—S14-007: IT Standard Encryption).

▪ The transmission of Confidential Data through web applications or email without encryption is prohibited.

▪ Wireless networks must utilize an encryption method approved by the New York State Standard (New York State Information Technology Standard No. NYS—S14-007: IT Standard Encryption).

6.1.9 Personnel Security

▪ All employees, vendors, and subcontractors engaged by CUNY are required to sign a Confidentiality Disclosure Agreement (CDA) form.

▪ Prior to granting access to systems containing Confidential Data, background clearance must be obtained from the individuals.

6.2 Risk Management Requirements

6.2.1 Risk Assessments

▪ Service Providers are required to conduct an annual assessment of the security controls in place on all information systems used for receiving, processing, storing, and transmitting Confidential Data. The CUNY Computing and Information Services (CIS) office will review the risks to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of Confidential Data.

▪ Service Providers are obligated to perform a risk assessment, or update an existing one if already in place, during the process of transferring Critical Infrastructure to a cloud-based environment. Subsequently, this risk assessment must be reviewed annually to account for any changes in the environment. The risk assessment should cover both the execution of the migration and an evaluation of the associated risks. The CUNY Computing and Information Services (CIS) cybersecurity office will assess the risk evaluation as part of the notification obligation.

▪ Organizational systems and applications should be scanned periodically for vulnerabilities and when new vulnerabilities affecting those systems and applications are identified. Vulnerabilities identified by the scans need to be remediated according to the risk level.

6.2.2 Annual Certifications

CUNY requires annual SOC1/SOC2/SSAE18 certification from vendors if they provide services like the following that may impact the Confidential Data of CUNY users or students’ entities:

https://its.ny.gov/system/files/documents/2023/04/nys-s14-007-encryption-standard.pdf https://its.ny.gov/system/files/documents/2023/04/nys-s14-007-encryption-standard.pdf

July 15, 2024 Page 8 of 12

▪ Data center provider

▪ Software as a service (SaaS)

▪ Any managed services-dealing with confidential data

▪ Payroll processors

▪ Medical Claim Processor

▪ Loan serving company

▪ Any Service Provider that process/collect payments on behalf of CUNY

6.2.3 Monitoring

▪ CUNY systems will be monitored and governed by CUNY Data Loss Prevention (DLP) policies.

▪ Service Providers are required to establish and utilize automated systems for monitoring and controlling remote access sessions. The primary objectives of this are to identify potential cyber-attacks and to ensure ongoing compliance with remote access policies.

This is accomplished by auditing the connection activities of remote users across various system components, including servers, workstations, laptops, smartphones, and tablets.

▪ Service Providers are obligated to generate and maintain system audit logs and records to the extent necessary to facilitate the monitoring, analysis, investigation, and reporting of illegal or unauthorized system activity.

6.2.4 Configuration Management/Change Management

▪ It is crucial to establish and consistently uphold baseline configurations and inventories for all Service Provider organizational systems, including hardware, software, firmware, and documentation. These baselines and inventories should be maintained throughout the entire life cycle of the Service Provider's system development.

▪ Establish and enforce security configuration settings for information technology products used in Service Provider systems. All changes should be tracked, reviewed, and either approved or disapproved. Changes to Service Provider systems should be logged. All changes must be analyzed for security impact before implementation. All documentation should be maintained and made available for audit.

▪ The Service Provider should review, define, document, approve, and enforce physical and logical access restrictions associated with changes to systems that have access to, store, or process Confidential Data.

▪ Adhere to the principle of least functionality by configuring Service Provider systems to provide only essential capabilities. Service Providers shall adhere to the New York State Information Technology Standard, No. NYS-S14-008; IT Standards: Secure Configuration.

6.3 System and Information Integrity

▪ Logical Separation: Information should be segregated within the Service Provider’s network environment to prevent other customers who share physical or virtual space from accessing CUNY Provided Confidential Data. This aims to prevent unauthorized and unintended information transfer via shared system resources.

https://www.cuny.edu/about/administration/offices/cis/information-security/security-policies-procedures/ https://www.cuny.edu/about/administration/offices/cis/information-security/security-policies-procedures/ https://its.ny.gov/system/files/documents/2022/10/nys-s14-008_secure_configuration_standard.pdf https://its.ny.gov/system/files/documents/2022/10/nys-s14-008_secure_configuration_standard.pdf https://its.ny.gov/system/files/documents/2022/10/nys-s14-008_secure_configuration_standard.pdf

July 15, 2024 Page 9 of 12

▪ Any utilization or management of Confidential Data not related to this engagement must receive approval from the CUNY Cybersecurity Chief Risk Officer.

▪ Confidential Data, whether in physical or digital format, should not be removed from any CUNY worksite unless authorized by CUNY and with appropriate safeguards implemented.

▪ Cryptographic mechanisms should be implemented to prevent unauthorized disclosure of Confidential Data during transmission, unless alternative physical safeguards are already in place. This requirement applies to both internal and external networks and any system components capable of transmitting information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, and facsimile machines.

▪ Network sessions should be terminated after 30 minutes of inactivity.

▪ The Service Provider must provide protection from malicious code at system entry and exit points.